Our insights

Security insights that Cut Through the Noise. 

Timely breakdowns of breaches, vulnerabilities, and policy shifts, alongside practical write-ups on risk and compliance - the same plain-language approach we bring to every client engagement.

Illustration representing LetsDefend Infosec's insights and write-ups
All posts Cybercrime Data Breaches Law Enforcement Operations Nation-State Threats Phishing Policy & Compliance Threat Intelligence Vulnerabilities
Threat Intelligence
8 Sep 2026 5 min read

PEEP Toolkit Turns Chrome and Edge Into Post-Compromise Backdoors

Researchers have uncovered PEEP, a Chromium‑based post‑exploitation toolkit that masquerades as a bookmarks extension. It injects itself into Chrome and Edge profiles, bypasses store checks, and enables host command execution.

#Vulnerabilities #Browser Security #Threat Intelligence
LetsDefend Infosec Read more
Threat Intelligence
8 Sep 2026 4 min read

BigBear 2.0 Phishing‑as‑a‑Service Bypasses MFA at 258 Organizations

A phishing‑as‑a‑service platform dubbed BigBear 2.0 has actively bypassed multi‑factor authentication, stealing over 5,000 Microsoft 365 credentials across 258 victims. This brief outlines the operation, technical approach, impact, and immediate mitigations.

#Phishing-as-a-Service #MFA Bypass #Microsoft 365
LetsDefend Infosec Read more
Threat Intelligence
8 Sep 2026 4 min read

Microsoft 365 and SaaS Data Theft Campaign Leveraging Help‑Desk Vishing and Token Hijacking

Threat hunters have uncovered a coordinated extortion operation that steals credentials from Microsoft 365 and other SaaS platforms. The group uses help‑desk vishing, in‑the‑middle token theft, and residential‑proxy sign‑ins to target executives, then threatens exposure unless paid.

#Microsoft 365 #SaaS security #Threat intelligence
LetsDefend Infosec Read more
Threat Intelligence
7 Sep 2026 4 min read

REVSTEALER Deploys Persistent Modules That Disable Defender and Launch Crypto Miner

Elastic Security Labs uncovered four new modules linked to the REVSTEALER Windows stealer. One module disables Windows Update and Microsoft Defender before starting a cryptocurrency miner, persisting after the original stealer removes itself.

#Threat Intelligence #Malware #Windows
LetsDefend Infosec Read more
Threat Intelligence
1 Sep 2026 3 min read

Guildma (Astaroth) Malware Spread Through Brazilian Portuguese Phishing Email

On September 1, 2026, the SANS Internet Storm Center reported a Guildma (Astaroth) malware infection that arrived via a Brazilian Portuguese email. This brief analyzes the confirmed details, assesses the impact, and outlines immediate steps for organizations to reduce exposure.

#Malware #Phishing #Threat Intelligence
LetsDefend Infosec Read more
Threat Intelligence
24 Aug 2026 4 min read

Round 111: Threat Landscape Across Windows, Linux, and macOS

Round 111, published on August 23, 2026, spotlights emerging activity from Akira ransomware, Evooo1Bot Linux botnet, StubMaker RubyGems infostealer, MacSync Stealer infrastructure, and the hybrid Manic malware.

#Malware #Ransomware #Linux Botnet
LetsDefend Infosec Read more